Before I dabbled a bit with Docker. I wanted to dabble a bit with Podman because it seemed quite interesting. I reinstalled Pi OS Lite on my Pi 3B+ and installed Podman. Then I figured out what to run and started digging through the documentation. Apparently Docker containers work quite similar and even Docker compose can be used. Then I came across the auto update function and stumbled upon quadlets to use auto update and got confused. Then I tried reading up on Podman rootless and rootful and networking stuff and really got lost.
I want to run the following services:
- Heimdall
- Adguard Home
- Jellyfin
- Vaultwarden
- Nextcloud
I am not sure a Pi is even powerful enough to run these things but I am even more unsure about how to set things up. Do I use quadlets? Do I run containers? How do I do the networking so I can reach the containers (maybe even outside my home)?
Can someone point me in the right direction? I can’t seem to find the needed information.
Podman is quickly becoming shit as Red Hat continues to remove features and recommend you use Kubernetes. I ended up removing it from my servers and switching to Debian from Fedora because I don’t like Red Hat mucking about with our open source community software.
I still run Docker.
As someone who’s been wanting to test (and maybe move to Podman) in the future but hasn’t really spent any time on it, what features have Red hat removed from Podman?
My major beef is we used to be able to run a Podman generate command to make a user systemd file and auto start and stop containers with that. Even entire clusters of pods with one easy command and then just use the system level start and stop. They removed it in favor of “quadlet”which works fine for single containers, but for a compose, they literally just use Kubernetes syntax and the official documentation says just use Kubernetes. Well, what the fuck is Podman for then?
The biggest problem everyone ever has with Podman is it’s frustratingly obedient to SELinux. Docker just kind of makes its own permissions and opens its own ports and steamrolls past whatever security you have. Podman will refuse to read or write a directory for stupid reasons until you’ve gone round and round with SELinux, and then just when you have it working, when the container updates it locks the directory all over again(in my case, updating a Minecraft server to latest version would crash the server and lock the data directory). Red Hat continues to insist SELinux is cool and this is working as intended. Again, Docker just doesn’t give a shit and barges into the directory without a problem.
Now look here chap, Quadlet admittedly works fine. I personally just k3s anyway but .pod files work too.
Isn’t being obedient to SELinux a good thing? You could set it to permissive if you want, but MAC systems are essential for security and I personally wouldn’t go without them
Well that can be understandable, but AFAIK podman generate still works, so if you can’t do something with Quadlet, then you can stays with generate until then. For example, I’m using Quadlet and now podman generate too since my Rocky 9 podman can’t be upgraded to podman 5 which means no pod support for you.
Every complaint here is PEBKAC.
It’s a legit argument that Docker has a stable architecture while podman is still evolving, but that’s how software do. I haven’t seen anything that isn’t backward compatible, or very strongly deprecated with notice.
Complaining about selinux in 2024? Setenforce 0, audit2allow, and get on with it.
Docker doing that while selinux is enforcing is an actual bad thing that you don’t want.
For those who are out of the loop, why is podman shit? It is rootless and crazy fast.
It isn’t. It’s architecture changes pretty significantly with each version, which is annoying when you need it to be stable. It’s also dominated by Redhat, which is a legit concern since they’ll likely start paywalling capabilities eventually.
I have never seen any of those things. Podman is fast and rootless with almost no overhead. It has good compatibility with docker as well.
Also it would make zero sense to paywall podman as Kubernetes exists. Anyway RHEL is payed anyway.
@MightyCuriosity@sh.itjust.works @selfhosted@lemmy.world
A raspberry pi is not going to be powerful enough to run these things beyond a test setup or, a really small use-case. I’d only setup #Nextcloud with the SQlite setup. And don’t plan on using it for mass storage. and for heaven sakes keep a backup. :shiba_please:
That said, if your goal is simply to run these out of your home and you want to access it beyond your intranet, all you would need is a VPN back to your house.
Avoid openVPN :openvpn: Simply because it’s a resource hog, albeit the more reliable option. Wireguard would be better especially considering you’re already going to be bottlenecked by the pi :raspberrypi:
I’d recommend wireguard. here’s a guide.
I don’t know much about Podman or Quadlets. But, a Docker instance will work just fine. :docker:
Updates are not too tricky in my opinion. I can share my own update script for my Docker Nextcloud setup if you want. It’d probably be adaptable for jellyfin and whatever else.
Just make sure you expose the Nextcloud data directory as a volume outside the container. and before you back it up always try to update so that if you have to reinstall you’ll have a better chance of having a compatible backup.
Thanks! Looks interesting. I am not quite a fan of the performance hit a VPN brings but I feel like it’s something that I need to deal with in order to suit my usecase. I thought DDNS could help me out.
Yeah I might switch back to Docker and use Watchtower to auto update. Thank you again!
Oh, well yeah, you can do that too. In fact, you may not even need a DDNS. I don’t have one for my fedi server, and I only ever had to change the IP on my DNS after we got hit by an earthquake and all of the local datacenters went out.
I choose not to do the DNS option for 90% of the things I host. Partly because my ISP has limitations on which ports can be exposed and, in general, I prefer not to expose any ports especially when I am serving up my own data.
But that’s just my paranoia talking. :cat_rock_on:
VPN + DDNS is what I do. You may be thinking about the perf hit of putting all your home connections through a VPN. That’s not the idea here. For self hosted services you would set up a wireguard “server” at your house. Then you connect your phone back to it to access your services.
With Wireguard it’s pretty easy to do a split tunnel, so that the VPN connection is only used for traffic to your home servers. Nothing else is affected, and you have access to your house all the time.
This is better for security than DDNS + open ports, because you only need a single open UDP port. Port scanners won’t see that you are hosting services and you wouldn’t need to build mitigations for service-specific attacks.
As far as podman, I am migrating to it from a mix of native and docker services. I agree with others that getting things set up with Docker first will be easier. But having podman as an end goal is good. Daemonless and rootless are big benefits. As are being able to manage it as systemd units via quadlets.
I switched from Docker to Podman, because Podman is more secure (if rootless) but it was just hard to autostart containars. You have to start one by one because they don’t have a central service like docker. And watchtower and nextcloud AIO don’t work on Podman. So I switched back to docker.
Its actually much easier to autostart containers with Podman, as it has full Systemd integration, so you can handle them like any other service. All you need to do is write a simple .container file for the Podman built-in Quadlet service, which closely follows the normal Systemd .service file syntax.
My humble POV it’s to stick with whatever do the work.
I use podman mainly because it’s very easy to manage using systemd services. Unfortunately, the command for generating these service files, podman-generate, is deprecated and won’t receive new features.
Auto updating is done just using a simple tag and enabling a systemd timer to do it regularly for you.
It’s easiest to start with the rootful mode, you won’t have additional settings to set and no issues with permissions, UIDs and networking.
For networking, I always create a network per service I want to run. For example Nextcloud and its database would go in one network and you’d only forward the port for the webinterface for outside access.
In addition to networks I also use pods, this basically groups the containers together to start/stop them as one. If you use this, you have to set your port forwarding here.
Podman-generate was replaced by Quadlet .container files, which works better.
And a Pod also has it’s own virtual network, why manually create one?
